@rubytech/create-maxy-code 0.1.39 → 0.1.41

package/dist/index.js

@@ -1597,9 +1597,8 @@ function provisionRemoteSessionSecret() {
 // install-time admin-auth invariant. Walks every account.json
 // under accountsDir and compares its admins[] to the persistent users.json,
 // emitting one [install-invariant] line per divergence and one summary line.
-// Log-only (no install abort) so pre-Task-904 devices with already-divergent
-// state still upgrade; future sprint can promote to refuse-or-degrade once
-// the deployed fleet is audited clean. Mirror of
+// Log-only (no install abort); future sprint can promote to refuse-or-degrade
+// once the deployed fleet is audited clean. Mirror of
 // checkAdminAuthInvariant() in platform/lib/admins-write/src/index.ts.
 function runInstallInvariantCheck(usersFile, accountsDir) {
     const TAG = "[install-invariant]";
@@ -1686,71 +1685,23 @@ function deployPayload() {
     // Persistent config lives at ~/{configDir}/ — survives rm -rf ~/{installDir}
     const persistentDir = resolve(process.env.HOME ?? "/root", BRAND.configDir);
     const persistentPasswordFile = join(persistentDir, ".neo4j-password");
-    const persistentAccountsDir = join(persistentDir, "accounts");
     // Migrate: if password is in old location, move to persistent
     const oldPasswordFile = join(INSTALL_DIR, "platform/config/.neo4j-password");
     if (existsSync(oldPasswordFile) && !existsSync(persistentPasswordFile)) {
         mkdirSync(persistentDir, { recursive: true });
         cpSync(oldPasswordFile, persistentPasswordFile);
     }
-    const oldAccountsDir = join(INSTALL_DIR, "platform/config/accounts");
-    if (existsSync(oldAccountsDir) && !existsSync(persistentAccountsDir)) {
-        mkdirSync(persistentDir, { recursive: true });
-        cpSync(oldAccountsDir, persistentAccountsDir, { recursive: true });
-    }
-    // users.json lives at <persistentDir>/users.json. earlier
-    // installs wrote to <INSTALL_DIR>/platform/config/users.json (the wipe zone)
-    // and relied on a one-shot copy-up at first install plus a copy-back after
-    // every wipe. The copy-back overwrote LIVE with the FROZEN-AT-FIRST-INSTALL
-    // backup, dropping every admin row added since first install. Writers (paths.ts,
-    // admin-add, set-pin, seed-neo4j.sh, migrate-import.sh) now target the
+    // users.json lives at <persistentDir>/users.json. Writers (paths.ts,
+    // admin-add, set-pin, seed-neo4j.sh, migrate-import.sh) target the
     // persistent file directly — see comment in platform/ui/app/lib/paths.ts.
-    //
-    // Legacy pickup: if a pre-Task-904 install left users.json inside the wipe
-    // zone, copy it up once. Idempotent — guarded by !existsSync(persistentUsersFile).
-    // Safe to delete this block one release has been deployed
-    // everywhere; until then it absorbs upgrades from any pre-Task-904 version.
     const persistentUsersFile = join(persistentDir, "users.json");
-    const oldUsersFile = join(INSTALL_DIR, "platform/config/users.json");
-    if (existsSync(oldUsersFile) && !existsSync(persistentUsersFile)) {
-        mkdirSync(persistentDir, { recursive: true });
-        cpSync(oldUsersFile, persistentUsersFile);
-        console.log("  Migrated pre-Task-904 users.json to persistent storage.");
-    }
-    // Claude Code OAuth credentials legacy pickup. earlier
-    // installs shared `~/.claude/.credentials.json` across brands; the brand
-    // main service's `claude` SDK subprocess and admin server now read from
-    // `${persistDir}/.claude/.credentials.json` per the new
-    // Environment=CLAUDE_CONFIG_DIR= block in port-resolution.ts.
-    //
-    // Move-semantics: the FIRST brand to install grabs the legacy file. The
-    // operation is cpSync + unlinkSync (not renameSync) so it survives cross-
-    // volume `~/` mounts that would EXDEV-fail rename. Subsequent brand
-    // installs find no legacy file and require a fresh `claude /login`.
-    //
-    // Idempotency stamp at `${persistentDir}/.claude/.credentials-migrated`
-    // prevents re-pickup on re-installs of the same brand even if an operator
-    // later runs `claude /login` with no CLAUDE_CONFIG_DIR set, which would
-    // re-create the legacy path.
+    // Claude Code OAuth credentials live at
+    // `${persistDir}/.claude/.credentials.json`. The brand main service's
+    // `claude` SDK subprocess and admin server read from there via the
+    // Environment=CLAUDE_CONFIG_DIR= block in port-resolution.ts. Fresh
+    // installs prompt the operator to run `claude /login`.
     const persistentClaudeDir = join(persistentDir, ".claude");
-    const persistentCredsFile = join(persistentClaudeDir, ".credentials.json");
-    const legacyCredsFile = join(process.env.HOME ?? "/root", ".claude", ".credentials.json");
-    const credsMigratedStamp = join(persistentClaudeDir, ".credentials-migrated");
-    if (!existsSync(credsMigratedStamp)) {
-        mkdirSync(persistentClaudeDir, { recursive: true });
-        if (existsSync(legacyCredsFile) && !existsSync(persistentCredsFile)) {
-            cpSync(legacyCredsFile, persistentCredsFile);
-            try {
-                unlinkSync(legacyCredsFile);
-            }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                console.log(`  [install] claude-creds pickup: legacy unlink warn=${msg}`);
-            }
-            console.log(`  [install] claude-creds pickup: brand=${BRAND.hostname} source=${legacyCredsFile} target=${persistentCredsFile}`);
-        }
-        writeFileSync(credsMigratedStamp, new Date().toISOString() + "\n");
-    }
+    mkdirSync(persistentClaudeDir, { recursive: true });
     // pre-populate the brand `.claude.json` so the manager's
     // PTY-spawned `claude --verbose --remote-control` boots straight into the
     // session URL without stopping at the first-run theme picker or the
@@ -1813,31 +1764,9 @@ function deployPayload() {
             spawnSync("sleep", ["1"]);
         }
     }
-    // Migrate user data to {installDir}/data/ — outside the platform/ wipe zone.
-    // Runs after service stop to avoid copying files while the agent is writing.
-    // Once data/ is populated, subsequent reinstalls skip this entirely.
-    const dataDir = join(INSTALL_DIR, "data");
-    const dataAccountsDir = join(dataDir, "accounts");
-    const dataUploadsDir = join(dataDir, "uploads");
-    const oldLiveAccounts = join(INSTALL_DIR, "platform/config/accounts");
-    if (!existsSync(dataAccountsDir)) {
-        if (existsSync(oldLiveAccounts)) {
-            mkdirSync(dataDir, { recursive: true });
-            cpSync(oldLiveAccounts, dataAccountsDir, { recursive: true });
-            console.log("  Migrated accounts to data/.");
-        }
-        else if (existsSync(persistentAccountsDir)) {
-            mkdirSync(dataDir, { recursive: true });
-            cpSync(persistentAccountsDir, dataAccountsDir, { recursive: true });
-            console.log("  Restored accounts from persistent backup to data/.");
-        }
-    }
-    const oldLiveUploads = join(INSTALL_DIR, "platform/data/attachments");
-    if (!existsSync(dataUploadsDir) && existsSync(oldLiveUploads)) {
-        mkdirSync(dataDir, { recursive: true });
-        cpSync(oldLiveUploads, dataUploadsDir, { recursive: true });
-        console.log("  Migrated uploads to data/.");
-    }
+    // User data lives at {installDir}/data/ — outside the platform/ wipe zone.
+    // Install path creates this fresh; runtime writers populate it on demand.
+    mkdirSync(join(INSTALL_DIR, "data"), { recursive: true });
     // Wipe deployment directories to prevent stale files.
     // data/ is NOT wiped — it contains user data (accounts, uploads) that must survive.
     for (const dir of ["platform", "server", "maxy", "premium-plugins", "docs", ".claude"]) {
@@ -1862,11 +1791,9 @@ function deployPayload() {
     // users.json is read directly from persistentDir by both
     // platform/ui/app/lib/paths.ts (USERS_FILE = MAXY_DIR/users.json) and the
     // admin MCP plugin (USERS_FILE = CONFIG_DIR/users.json). No copy into the
-    // wipe zone — the pre-Task-904 cpSync to platform/config/users.json was the
-    // copy that overwrote new admin rows on every install. The line below
-    // observes the row count + userId prefixes so a future regression is grep-
-    // detectable in the install log without any runtime change (singular
-    // "userId preserved" hid the multi-row failure mode).
+    // wipe zone. The line below observes the row count + userId prefixes so a
+    // future regression is grep-detectable in the install log without any
+    // runtime change.
     if (existsSync(persistentUsersFile)) {
         try {
             const raw = readFileSync(persistentUsersFile, "utf-8").trim();
@@ -1886,8 +1813,7 @@ function deployPayload() {
     }
     // install-time admin-auth invariant check. Walks every
     // data/accounts/*/account.json admins[] and compares to the persistent
-    // users.json. Log-only (does NOT refuse install) so pre-Task-904 devices
-    // with already-divergent state still upgrade; the [install-invariant]
+    // users.json. Log-only (does NOT refuse install); the [install-invariant]
     // line surfaces the bug to the operator without bricking the device.
     // Inline rather than imported from platform/lib/admins-write because the
     // installer is its own npm package and doesn't bundle the platform lib.
@@ -2406,11 +2332,26 @@ function writeInstallDefaults(accountId) {
     writeFileSync(accountJsonPath, JSON.stringify(config, null, 2) + "\n");
     console.log(`  [install-defaults] account-json plugins=${enabledPlugins.length} outputStyle=default thinkingView=default`);
     logFile(`  [install-defaults] account-json plugins=${enabledPlugins.length} outputStyle=default thinkingView=default`);
+    // Admin SOUL.md is sourced from the bundled template with ${PRODUCT_NAME}
+    // substituted at install time. The template carries the Phase 1 standing
+    // offer (brochure / preval / Loop CRM) so the agent ships with a stated
+    // capability set rather than a one-line operator-tag.
     const soulPath = join(accountDir, "agents/admin/SOUL.md");
     mkdirSync(dirname(soulPath), { recursive: true });
-    writeFileSync(soulPath, `You are ${BRAND.productName}, an AI operations manager.\n`);
-    console.log(`  [install-defaults] soul-md path=${soulPath}`);
-    logFile(`  [install-defaults] soul-md path=${soulPath}`);
+    const adminSoulTemplate = join(INSTALL_DIR, "platform/templates/agents/admin/SOUL.md");
+    let soulContent;
+    try {
+        soulContent = readFileSync(adminSoulTemplate, "utf-8");
+    }
+    catch (err) {
+        console.error(`  [install-defaults] admin-soul template missing at ${adminSoulTemplate}: ${err.message}`);
+        logFile(`  [install-defaults] admin-soul template missing: ${err.message}`);
+        return;
+    }
+    soulContent = soulContent.replace(/\$\{PRODUCT_NAME\}/g, BRAND.productName);
+    writeFileSync(soulPath, soulContent);
+    console.log(`  [install-defaults] soul-md path=${soulPath} bytes=${soulContent.length}`);
+    logFile(`  [install-defaults] soul-md path=${soulPath} bytes=${soulContent.length}`);
     // Public agent files — IDENTITY.md is always overwritten (Rubytech-controlled);
     // SOUL.md and config.json are created if missing (user-controlled). All three
     // are sourced from the payload templates under
@@ -2552,13 +2493,6 @@ function resolveInstallAccountId() {
     catch { /* directory unreadable */ }
     return "";
 }
-// `installCrons()` and the `# BEGIN/END <BRAND> CRONS` block lived
-// here. All such events must be user-driven, not scheduled by the installer.
-// The legacy block recreated `data/accounts/<accountId>/logs/` every 60s via
-// `mkdir -p`, which tripped seed-neo4j.sh's stub-account-dirs guard on every
-// reinstall after `rm -rf ~/<installDir>`. Uninstall now strips the legacy
-// block (uninstall.ts `removeLegacyCronBlock`) so older installs migrate
-// cleanly. Consumer-side dispatcher replacement is tracked separately.
 // retired the ttyd/tmux/xterm admin terminal stack. Upgrades run
 // via the action runner — `systemd-run --user` transient units spawned by
 // POST /api/admin/actions/upgrade — whose lifetime is independent of

package/dist/uninstall.js

@@ -158,11 +158,7 @@ function stopServices() {
     // the edge service owns the public port and VNC stack. Stop it
     // after the main brand service so the edge's ExecStopPost (vnc.sh stop)
     // runs cleanly. The edge unit is per-brand (`<hostname>-edge`).
-    // retired the ttyd unit; pre-664 devices may still have
-    // `<hostname>-ttyd` — best-effort stop so the uninstall is clean on
-    // upgraded devices too.
     const edgeUnitShort = `${BRAND.hostname}-edge`;
-    const legacyTtydUnitShort = `${BRAND.hostname}-ttyd`;
     try {
         spawnSync("systemctl", ["--user", "stop", edgeUnitShort], { stdio: "pipe", timeout: 15_000 });
         console.log(`  Stopped ${edgeUnitShort}`);
@@ -170,11 +166,6 @@ function stopServices() {
     catch {
         console.log(`  ${edgeUnitShort} not running`);
     }
-    try {
-        spawnSync("systemctl", ["--user", "stop", legacyTtydUnitShort], { stdio: "pipe", timeout: 15_000 });
-        console.log(`  Stopped ${legacyTtydUnitShort} (legacy pre-664 unit)`);
-    }
-    catch { /* not present on post-664 installs */ }
     // Stop Neo4j — dedicated branded instance if this brand uses one, else shared.
     // Brand isolation: never stop `neo4j.service` when this brand runs
     // a dedicated `neo4j-<hostname>.service` — stopping the shared instance would
@@ -234,80 +225,6 @@ function stopServices() {
     console.log("  Stopped Ollama");
 }
 // ---------------------------------------------------------------------------
-// Step 1b: Strip the legacy installer-registered cron block
-//
-// retired `installCrons()` in src/index.ts. Older installs (every
-// brand prior to the release) wrote three minute-cadence entries
-// between `# BEGIN <BRAND> CRONS` and `# END <BRAND> CRONS`. This step
-// removes that block on uninstall so an upgraded device is fully torn down
-// and a subsequent reinstall does not get re-seeded by cron recreating
-// `data/accounts/<accountId>/logs/` every 60s (which tripped seed-neo4j.sh's
-// stub-account-dirs guard). Idempotent:
-// no-op when the block is absent. Gated on Linux to mirror the installer's
-// `installCrons` which early-returned on every other platform.
-// ---------------------------------------------------------------------------
-function removeLegacyCronBlock() {
-    log("1b", "Removing legacy cron block...");
-    if (!isLinux()) {
-        console.log("  Skipped — non-Linux platform.");
-        return;
-    }
-    if (!commandExists("crontab")) {
-        console.log("  crontab not available — nothing to strip.");
-        return;
-    }
-    const current = spawnSync("crontab", ["-l"], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
-    // Non-zero status (or empty stdout) on `crontab -l` means the user has no
-    // crontab at all — nothing to strip, and writing back would create one.
-    if (current.status !== 0 || !current.stdout) {
-        console.log("  Cron block: none present");
-        return;
-    }
-    const beginMarker = `# BEGIN ${BRAND.productName.toUpperCase()} CRONS`;
-    const endMarker = `# END ${BRAND.productName.toUpperCase()} CRONS`;
-    const escapeRegex = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const blockPattern = new RegExp(`${escapeRegex(beginMarker)}[\\s\\S]*?${escapeRegex(endMarker)}\\n?`, "g");
-    // Count entry lines (non-comment, non-blank) between markers for the
-    // operator-visible log. matchAll returns all block bodies in one pass.
-    const extractPattern = new RegExp(`${escapeRegex(beginMarker)}([\\s\\S]*?)${escapeRegex(endMarker)}`, "g");
-    let entryCount = 0;
-    for (const match of current.stdout.matchAll(extractPattern)) {
-        entryCount += match[1]
-            .split("\n")
-            .filter((l) => l.trim().length > 0 && !l.trim().startsWith("#"))
-            .length;
-    }
-    if (entryCount === 0 && !blockPattern.test(current.stdout)) {
-        console.log("  Cron block: none present");
-        return;
-    }
-    const stripped = current.stdout.replace(blockPattern, "").trimEnd();
-    if (stripped.length === 0) {
-        // Block was the only content — remove the crontab outright so `crontab -l`
-        // reports "no crontab for admin" (success criterion). Writing an
-        // empty buffer via `crontab -` leaves a zero-byte crontab on Debian.
-        const removed = spawnSync("crontab", ["-r"], { stdio: "pipe" });
-        if (removed.status !== 0) {
-            console.log(`  Cron block: stripped ${entryCount} entries but crontab -r failed — ${(removed.stderr ?? "").toString().trim()}`);
-            logFile(`  crontab -r failed: ${removed.stderr}`);
-            return;
-        }
-    }
-    else {
-        const write = spawnSync("crontab", ["-"], {
-            input: stripped + "\n",
-            encoding: "utf-8",
-            stdio: ["pipe", "pipe", "pipe"],
-        });
-        if (write.status !== 0) {
-            console.log(`  Cron block: write failed — ${(write.stderr ?? "").trim()}`);
-            logFile(`  crontab write failed: ${write.stderr}`);
-            return;
-        }
-    }
-    console.log(`  Cron block: removed ${entryCount} entries`);
-}
-// ---------------------------------------------------------------------------
 // Step 2: Delete Cloudflare tunnel
 // ---------------------------------------------------------------------------
 function deleteCloudflareTunnel() {
@@ -702,27 +619,20 @@ function removeSystemdService() {
             console.log(`  Failed to remove service file: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
-    // remove this brand's per-brand edge unit alongside the
-    // main brand unit. The per-brand ttyd unit is retired, but an
-    // upgraded device may still have `<hostname>-ttyd.service` on disk from
-    // a pre-664 install — cleanup both so the uninstall leaves nothing
-    // behind on either generation.
+    // remove this brand's per-brand edge unit alongside the main brand unit.
     const thisBrandEdge = `${BRAND.hostname}-edge`;
-    const legacyBrandTtyd = `${BRAND.hostname}-ttyd`;
-    for (const unit of [thisBrandEdge, legacyBrandTtyd]) {
+    try {
+        spawnSync("systemctl", ["--user", "disable", thisBrandEdge], { stdio: "pipe" });
+    }
+    catch { /* ignore */ }
+    const edgeUnitFile = resolve(HOME, `.config/systemd/user/${thisBrandEdge}.service`);
+    if (existsSync(edgeUnitFile)) {
         try {
-            spawnSync("systemctl", ["--user", "disable", unit], { stdio: "pipe" });
+            rmSync(edgeUnitFile);
+            console.log(`  Removed ${thisBrandEdge}.service`);
         }
-        catch { /* ignore */ }
-        const unitFile = resolve(HOME, `.config/systemd/user/${unit}.service`);
-        if (existsSync(unitFile)) {
-            try {
-                rmSync(unitFile);
-                console.log(`  Removed ${unit}.service`);
-            }
-            catch (err) {
-                console.log(`  Failed to remove ${unit}.service: ${err instanceof Error ? err.message : String(err)}`);
-            }
+        catch (err) {
+            console.log(`  Failed to remove ${thisBrandEdge}.service: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
     // Reload daemon
@@ -965,7 +875,6 @@ export async function runUninstall(options) {
     const failures = [];
     const steps = [
         { name: "Stop services", fn: stopServices },
-        { name: "Remove legacy cron block", fn: removeLegacyCronBlock },
         { name: "Delete Cloudflare tunnel", fn: deleteCloudflareTunnel },
         ...(options.exportPath
             ? [{ name: "Export data", fn: () => exportData(options.exportPath) }]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.39",
+  "version": "0.1.41",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/lib/mcp-stderr-tee/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "@maxy/mcp-stderr-tee",
+  "version": "0.1.0",
+  "private": true,
+  "type": "commonjs",
+  "main": "dist/index.js"
+}

package/payload/platform/plugins/admin/hooks/turn-completed-graph-write.sh

@@ -1,37 +1,71 @@
 #!/usr/bin/env bash
 # Stop hook — fires on every completed admin-agent turn and dispatches one
-# background PTY against `specialists:database-operator` with the just-
-# completed turn payload as stdin. The hidden PTY is the only writer to the
-# Neo4j graph; the admin agent stays focused on the operator's request.
+# background PTY against `specialists:database-operator`. The hidden PTY is
+# the only writer to the Neo4j graph; the admin agent stays focused on the
+# operator's request.
+#
+# Pipeline (Task 094 redesign):
+#   1. /spawn (no stdinPayload) — manager awaits its watcher's PID-file
+#      event before returning. Response carries the recorder's intrinsic
+#      sessionId.
+#   2. POST /<recorder-sessionId>/input — body is the database-operator
+#      prompt followed by the filtered JSONL tail of the just-completed
+#      turn (user / assistant / tool-call records only; queue-operation,
+#      auto_mode, deferred_tools_delta, hook_*, last-prompt, skill_listing,
+#      mcp_instructions_delta, permission-mode are dropped).
+#   3. When the recorder's Stop hook fires, this hook runs again INSIDE
+#      the recorder PTY; the MAXY_HIDDEN_SPAWN gate exits early so no
+#      recursion. The recorder's PTY exits naturally; its Stop is then
+#      driven by POST /<sessionId>/stop from the same hook invocation
+#      that posted /input.
 #
 # Gating:
-#   - MAXY_SESSION_ROLE must equal "admin" (skip public PTYs)
-#   - MAXY_HIDDEN_SPAWN must equal "0" (skip recursive fires from the
-#     hidden database-operator PTY itself; without this gate every
-#     recorder turn would spawn another recorder forever)
+#   - MAXY_SESSION_ROLE must equal "admin"
+#   - MAXY_HIDDEN_SPAWN must equal "0" (skip recursive fires)
 #
 # Input: Claude Code's Stop hook stdin shape
 #   { "session_id": "<intrinsic>", "transcript_path": "<jsonl path>", ... }
 #
-# Output: one log line per fire on the user-facing session's stderr
-#   `turn-completed-graph-write fired conversationId=<8> tail-bytes=<n> ms=<n>`
-#
-# Failure modes are silent (exit 0) — this hook is observability + write
-# orchestration; a failure here must never break the operator's session.
+# Failure modes are silent (exit 0) — a failure here must never break the
+# operator's session.
 
 set -uo pipefail
 
 START_MS=$(python3 -c 'import time; print(int(time.time()*1000))')
 
-# Gate 1: only fire on admin foreground PTYs.
 if [ "${MAXY_SESSION_ROLE:-}" != "admin" ]; then
   exit 0
 fi
 if [ "${MAXY_HIDDEN_SPAWN:-0}" = "1" ]; then
+  # Recorder PTY's own Stop hook. Read its session_id and ask the manager
+  # to SIGTERM the recorder so it does not idle in the active recents list
+  # after its single turn completes. Keep the JSONL — it's the audit trail.
+  if [ -t 0 ]; then
+    exit 0
+  fi
+  REC_INPUT=$(cat)
+  if [ -z "$REC_INPUT" ]; then
+    exit 0
+  fi
+  REC_SESSION_ID=$(printf '%s' "$REC_INPUT" | python3 -c '
+import sys, json
+try:
+  d = json.load(sys.stdin)
+  print(d.get("session_id", "") or "")
+except Exception:
+  print("")
+' 2>/dev/null)
+  if [ -z "$REC_SESSION_ID" ]; then
+    exit 0
+  fi
+  REC_PORT="${CLAUDE_SESSION_MANAGER_PORT:-19400}"
+  curl -sS -X POST \
+    --max-time 5 \
+    "http://127.0.0.1:${REC_PORT}/${REC_SESSION_ID}/stop" >/dev/null 2>&1
+  echo "[recorder] self-stop sessionId=${REC_SESSION_ID:0:8}" >&2
   exit 0
 fi
 
-# Gate 2: stdin must be a JSON envelope. Fail-open on parse failure.
 if [ -t 0 ]; then
   exit 0
 fi
@@ -40,8 +74,6 @@ if [ -z "$INPUT" ]; then
   exit 0
 fi
 
-# Extract session_id and transcript_path via python3 (grep on JSON is
-# fragile when values carry escaped quotes).
 PARSED=$(printf '%s' "$INPUT" | python3 -c '
 import sys, json
 try:
@@ -52,63 +84,121 @@ try:
 except Exception:
     print("\t")
 ' 2>/dev/null)
-SESSION_ID="${PARSED%%	*}"
+ADMIN_SESSION_ID="${PARSED%%	*}"
 TRANSCRIPT_PATH="${PARSED#*	}"
 
-if [ -z "$SESSION_ID" ] || [ -z "$TRANSCRIPT_PATH" ] || [ ! -f "$TRANSCRIPT_PATH" ]; then
+if [ -z "$ADMIN_SESSION_ID" ] || [ -z "$TRANSCRIPT_PATH" ] || [ ! -f "$TRANSCRIPT_PATH" ]; then
   exit 0
 fi
 
-# Read last 64 KiB of the transcript — enough for one completed turn
-# including a moderate tool transcript, bounded so the POST body never
-# balloons. tail -c is portable across BSD and GNU.
-TAIL_BYTES=$(wc -c < "$TRANSCRIPT_PATH" 2>/dev/null | tr -d ' ')
-TAIL_BYTES="${TAIL_BYTES:-0}"
-TURN_TAIL=$(tail -c 65536 "$TRANSCRIPT_PATH" 2>/dev/null)
+# Filter the JSONL tail down to records the database-operator cares about:
+# user prompts, assistant messages, and tool calls. Drop ephemeral
+# admin-state records that bloat the prompt without graph value.
+FILTERED_TAIL=$(python3 - "$TRANSCRIPT_PATH" <<'PY'
+import sys, json
+DROP = {
+  'queue-operation', 'auto_mode', 'deferred_tools_delta',
+  'last-prompt', 'skill_listing', 'mcp_instructions_delta',
+  'permission-mode',
+}
+def keep(rec):
+  t = rec.get('type') if isinstance(rec, dict) else None
+  if not isinstance(t, str): return False
+  if t in DROP: return False
+  if t.startswith('hook_'): return False
+  if t in ('user', 'assistant', 'message'): return True
+  if 'tool' in t.lower(): return True
+  return False
+
+path = sys.argv[1]
+# Read whole file; admin transcripts are bounded by Claude Code's own
+# compaction so the read cost is reasonable. Take the last 200 records
+# from the kept set so a long transcript doesn't blow the prompt budget.
+out = []
+try:
+  with open(path, 'r', encoding='utf-8') as f:
+    for line in f:
+      line = line.strip()
+      if not line: continue
+      try: rec = json.loads(line)
+      except Exception: continue
+      if keep(rec): out.append(rec)
+except Exception:
+  pass
+out = out[-200:]
+print(json.dumps(out, separators=(',', ':')))
+PY
+)
+
+FILTERED_COUNT=$(printf '%s' "$FILTERED_TAIL" | python3 -c 'import sys,json; d=json.load(sys.stdin); print(len(d) if isinstance(d,list) else 0)' 2>/dev/null || echo 0)
 
-# Manager port — environment override or compile-time default. The
-# installer's systemd unit stamps CLAUDE_SESSION_MANAGER_PORT so this
-# resolves to the brand's loopback port at runtime.
 MANAGER_PORT="${CLAUDE_SESSION_MANAGER_PORT:-19400}"
+MANAGER_BASE="http://127.0.0.1:${MANAGER_PORT}"
 
-# Build the /spawn body. The recorder gets the raw transcript tail in
-# stdinPayload; the recorder agent parses the JSONL records itself
-# (admin-agent JSONL is more authoritative than any post-hoc summary the
-# hook could synthesise).
+# Spawn the recorder PTY. Manager blocks on its watcher's PID-file event
+# and returns the recorder's intrinsic sessionId in the response body.
 SPAWN_BODY=$(python3 -c '
-import sys, json
-sid = sys.argv[1]
-tail = sys.argv[2]
+import json, sys
 body = {
-    "senderId": "turn-recorder",
-    "role": "admin",
-    "channel": "browser",
-    "hidden": True,
-    "specialist": "database-operator",
-    "stdinPayload": json.dumps({
-        "conversationId": sid,
-        "occurredAt": __import__("datetime").datetime.utcnow().isoformat() + "Z",
-        "transcriptTail": tail,
-    }),
+  "senderId": "turn-recorder",
+  "role": "admin",
+  "channel": "browser",
+  "hidden": True,
+  "specialist": "database-operator",
 }
 print(json.dumps(body))
-' "$SESSION_ID" "$TURN_TAIL" 2>/dev/null)
+')
 
-if [ -z "$SPAWN_BODY" ]; then
+SPAWN_RES=$(curl -sS -X POST \
+  -H 'Content-Type: application/json' \
+  --max-time 10 \
+  --data "$SPAWN_BODY" \
+  "${MANAGER_BASE}/spawn" 2>/dev/null)
+
+RECORDER_SESSION_ID=$(printf '%s' "$SPAWN_RES" | python3 -c '
+import sys, json
+try:
+  d = json.load(sys.stdin)
+  print(d.get("sessionId", "") or "")
+except Exception:
+  print("")
+' 2>/dev/null)
+
+if [ -z "$RECORDER_SESSION_ID" ]; then
+  echo "turn-completed-graph-write spawn-failed conversationId=${ADMIN_SESSION_ID:0:8}" >&2
   exit 0
 fi
 
-# Fire-and-forget POST. The manager returns 200 on URL capture (~2 s);
-# we do not wait for it. curl is preferred (universally present on
-# Linux/macOS) — failure is silent.
+# Compose the input message: prompt prefix + filtered transcript JSON.
+INPUT_BODY=$(python3 -c '
+import sys, json
+sid = sys.argv[1]
+tail_json = sys.argv[2]
+prompt = (
+  "You are the database-operator specialist. Record the following completed turn "
+  "into the Neo4j graph. The transcript is a JSON array of filtered records "
+  "from the admin agent (user prompts, assistant responses, tool calls). "
+  f"Conversation id: {sid}.\n\nTranscript:\n{tail_json}\n"
+)
+print(json.dumps({"text": prompt}))
+' "$ADMIN_SESSION_ID" "$FILTERED_TAIL" 2>/dev/null)
+
+if [ -z "$INPUT_BODY" ]; then
+  exit 0
+fi
+
+INPUT_BYTES=$(printf '%s' "$INPUT_BODY" | wc -c | tr -d ' ')
+
 curl -sS -X POST \
   -H 'Content-Type: application/json' \
   --max-time 5 \
-  --data "$SPAWN_BODY" \
-  "http://127.0.0.1:${MANAGER_PORT}/spawn" >/dev/null 2>&1 &
+  --data "$INPUT_BODY" \
+  "${MANAGER_BASE}/${RECORDER_SESSION_ID}/input" >/dev/null 2>&1
+
+echo "[recorder] input-posted sessionId=${RECORDER_SESSION_ID:0:8} bytes=${INPUT_BYTES} filtered-from-records=${FILTERED_COUNT}" >&2
 
 END_MS=$(python3 -c 'import time; print(int(time.time()*1000))')
 ELAPSED=$((END_MS - START_MS))
-echo "turn-completed-graph-write fired conversationId=${SESSION_ID:0:8} tail-bytes=${TAIL_BYTES} ms=${ELAPSED}" >&2
+echo "turn-completed-graph-write fired conversationId=${ADMIN_SESSION_ID:0:8} recorderSessionId=${RECORDER_SESSION_ID:0:8} filtered=${FILTERED_COUNT} ms=${ELAPSED}" >&2
 
 exit 0